WordPress MDJM Event Management Plugin Privilege Escalation Flaw

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 contain a role deletion vulnerability that can be exploited by unauthenticated attackers.

The plugin acts on a role deletion request on every page load with no capability check and no nonce. The guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted.

• Affected versions: through 1.7.8.7
• Impact: attackers can remove any WordPress role including administrator, permanently stripping every user of their capabilities